Splunk Enterprise Security

How do I suppress possible typo in web.conf for ESS on 4.2

hazekamp
Builder

When I start my Splunk server I see

Possible typo in stanza [settings] in $SPLUNK_HOME/etc/apps/SplunkEnterpriseSecuritySuite/default/web.conf, line: 2: disabled_decomposers = addtermgt, addtermlt

Is this a configuration error? How can I suppress this message?

1 Solution

hazekamp
Builder

This is not a configuration error, rather a setting that has been deprecated in 4.2. In 4.1.5+ one was able to selectively disable decomposers; however in 4.2 decomposition is selectively enabled via the "enable_decomposers" setting.

This message can and should be suppressed (and will be for 4.2.x only compatible builds of ESS):

To suppress, comment (prepend a '#' to) the following line in $SPLUNK_HOME/etc/apps/SplunkEnterpriseSecuritySuite/default/web.conf

Was:

disabled_decomposers = addtermgt, addtermlt

Should be:

#disabled_decomposers = addtermgt, addtermlt

Typically we do not advocate changing "default" configuration files; however, since this is a deprecated setting it cannot be overridden as it should not exist in the first place.

View solution in original post

hazekamp
Builder

This is not a configuration error, rather a setting that has been deprecated in 4.2. In 4.1.5+ one was able to selectively disable decomposers; however in 4.2 decomposition is selectively enabled via the "enable_decomposers" setting.

This message can and should be suppressed (and will be for 4.2.x only compatible builds of ESS):

To suppress, comment (prepend a '#' to) the following line in $SPLUNK_HOME/etc/apps/SplunkEnterpriseSecuritySuite/default/web.conf

Was:

disabled_decomposers = addtermgt, addtermlt

Should be:

#disabled_decomposers = addtermgt, addtermlt

Typically we do not advocate changing "default" configuration files; however, since this is a deprecated setting it cannot be overridden as it should not exist in the first place.

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...